[exim-cvs] Fix $mime_part_count for non-mime message on mul…

Top Page
Delete this message
Reply to this message
Author: Exim Git Commits Mailing List
Date:  
To: exim-cvs
Subject: [exim-cvs] Fix $mime_part_count for non-mime message on multi-message connection. Bug 2537
Gitweb: https://git.exim.org/exim.git/commitdiff/b273058b341903372bdebe67d2960e4f8d2d8689
Commit:     b273058b341903372bdebe67d2960e4f8d2d8689
Parent:     84a655513611641b55a8f46c13ee0e3cb141477f
Author:     Jeremy Harris <jgh146exb@???>
AuthorDate: Sun Mar 1 14:05:43 2020 +0000
Committer:  Jeremy Harris <jgh146exb@???>
CommitDate: Sun Mar 1 15:10:32 2020 +0000


    Fix $mime_part_count for non-mime message on multi-message connection.  Bug 2537
---
 doc/doc-docbook/spec.xfpt                 |  24 ++-
 doc/doc-txt/ChangeLog                     |   3 +
 src/src/mime.c                            |  52 +++----
 src/src/receive.c                         |   8 +
 src/src/string.c                          |  16 +-
 test/confs/4001                           |  46 ++----
 test/confs/4002                           |  53 ++++---
 test/confs/4003                           |  13 +-
 test/confs/{4003 => 4004}                 |   0
 test/confs/4015                           |  39 ++++-
 test/log/4001                             |   6 -
 test/log/4002                             |  19 +--
 test/log/4003                             |  17 +-
 test/log/{4003 => 4004}                   |   0
 test/mail/{4001.userx => 4002.userx}      |   0
 test/runtest                              |   3 +
 test/scripts/4000-scanning/4001           | 104 ++++++++-----
 test/scripts/4000-scanning/4002           | 248 +++---------------------------
 test/scripts/4000-scanning/4003           | 225 +++++++++++++++++++++++++--
 test/scripts/4000-scanning/{4003 => 4004} |   0
 test/stderr/4001                          | 116 ++++++++++++++
 test/stderr/4004                          |   3 -
 test/stdout/4001                          |  38 +++--
 test/stdout/4002                          | 209 +------------------------
 test/stdout/4003                          | 216 +++++++++++++++++++++++---
 test/stdout/{4003 => 4004}                |   0
 26 files changed, 830 insertions(+), 628 deletions(-)


diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index f9bdbd8..42a84db 100644
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -33704,13 +33704,22 @@ The following list describes all expansion variables that are
available in the MIME ACL:

 .vlist
+.vitem &$mime_anomaly_level$& &&&
+       &$mime_anomaly_text$&
+.vindex &$mime_anomaly_level$&
+.vindex &$mime_anomaly_text$&
+If there are problems decoding, these variables contain information on
+the detected issue.
+
 .vitem &$mime_boundary$&
-If the current part is a multipart (see &$mime_is_multipart$&) below, it should
+.vindex &$mime_boundary$&
+If the current part is a multipart (see &$mime_is_multipart$& below), it should
 have a boundary string, which is stored in this variable. If the current part
 has no boundary parameter in the &'Content-Type:'& header, this variable
 contains the empty string.


.vitem &$mime_charset$&
+.vindex &$mime_charset$&
This variable contains the character set identifier, if one was found in the
&'Content-Type:'& header. Examples for charset identifiers are:
.code
@@ -33722,31 +33731,37 @@ Please note that this value is not normalized, so you should do matches
case-insensitively.

.vitem &$mime_content_description$&
+.vindex &$mime_content_description$&
This variable contains the normalized content of the &'Content-Description:'&
header. It can contain a human-readable description of the parts content. Some
implementations repeat the filename for attachments here, but they are usually
only used for display purposes.

.vitem &$mime_content_disposition$&
+.vindex &$mime_content_disposition$&
This variable contains the normalized content of the &'Content-Disposition:'&
header. You can expect strings like &"attachment"& or &"inline"& here.

.vitem &$mime_content_id$&
+.vindex &$mime_content_id$&
This variable contains the normalized content of the &'Content-ID:'& header.
This is a unique ID that can be used to reference a part from another part.

.vitem &$mime_content_size$&
+.vindex &$mime_content_size$&
This variable is set only after the &%decode%& modifier (see above) has been
successfully run. It contains the size of the decoded part in kilobytes. The
size is always rounded up to full kilobytes, so only a completely empty part
has a &$mime_content_size$& of zero.

.vitem &$mime_content_transfer_encoding$&
+.vindex &$mime_content_transfer_encoding$&
This variable contains the normalized content of the
&'Content-transfer-encoding:'& header. This is a symbolic name for an encoding
type. Typical values are &"base64"& and &"quoted-printable"&.

.vitem &$mime_content_type$&
+.vindex &$mime_content_type$&
If the MIME part has a &'Content-Type:'& header, this variable contains its
value, lowercased, and without any options (like &"name"& or &"charset"&). Here
are some examples of popular MIME types, as they may appear in this variable:
@@ -33761,6 +33776,7 @@ If the MIME part has no &'Content-Type:'& header, this variable contains the
empty string.

.vitem &$mime_decoded_filename$&
+.vindex &$mime_decoded_filename$&
This variable is set only after the &%decode%& modifier (see above) has been
successfully run. It contains the full path and filename of the file
containing the decoded data.
@@ -33769,6 +33785,7 @@ containing the decoded data.
.cindex "RFC 2047"
.vlist
.vitem &$mime_filename$&
+.vindex &$mime_filename$&
This is perhaps the most important of the MIME variables. It contains a
proposed filename for an attachment, if one was found in either the
&'Content-Type:'& or &'Content-Disposition:'& headers. The filename will be
@@ -33779,6 +33796,7 @@ decoded, but no additional sanity checks are done.
found, this variable contains the empty string.

.vitem &$mime_is_coverletter$&
+.vindex &$mime_is_coverletter$&
This variable attempts to differentiate the &"cover letter"& of an e-mail from
attached data. It can be used to clamp down on flashy or unnecessarily encoded
content in the cover letter, while not restricting attachments at all.
@@ -33811,18 +33829,22 @@ deny message = HTML mail is not accepted here
condition = $mime_is_coverletter
condition = ${if eq{$mime_content_type}{text/html}{1}{0}}
.endd
+
.vitem &$mime_is_multipart$&
+.vindex &$mime_is_multipart$&
This variable has the value 1 (true) when the current part has the main type
&"multipart"&, for example, &"multipart/alternative"& or &"multipart/mixed"&.
Since multipart entities only serve as containers for other parts, you may not
want to carry out specific actions on them.

.vitem &$mime_is_rfc822$&
+.vindex &$mime_is_rfc822$&
This variable has the value 1 (true) if the current part is not a part of the
checked message itself, but part of an attached message. Attached message
decoding is fully recursive.

 .vitem &$mime_part_count$&
+.vindex &$mime_part_count$&
 This variable is a counter that is raised for each processed MIME part. It
 starts at zero for the very first part (which is usually a multipart). The
 counter is per-message, so it is reset when processing RFC822 attachments (see
diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index db06d49..7e0fbf7 100644
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -140,6 +140,9 @@ JH/28 Bug 2533: Fix expansion of ${tr } item.  When called in some situations
       it could crash from a null-deref.  This could also affect the
       ${addresses: } operator and ${readsock } item.


+JH/29 Bug 2537: Fix $mime_part_count.  When a single connection had a non-mime
+      message following a mime one, the variable was not reset.
+


Exim version 4.93
-----------------
diff --git a/src/src/mime.c b/src/src/mime.c
index d47b569..f1efa5c 100644
--- a/src/src/mime.c
+++ b/src/src/mime.c
@@ -107,23 +107,23 @@ return initial_pos;
static ssize_t
mime_decode_asis(FILE* in, FILE* out, uschar* boundary)
{
- ssize_t len, size = 0;
- uschar buffer[MIME_MAX_LINE_LENGTH];
+ssize_t len, size = 0;
+uschar buffer[MIME_MAX_LINE_LENGTH];

-  while(fgets(CS buffer, MIME_MAX_LINE_LENGTH, mime_stream) != NULL)
-    {
-    if (boundary != NULL
-       && Ustrncmp(buffer, "--", 2) == 0
-       && Ustrncmp((buffer+2), boundary, Ustrlen(boundary)) == 0
-       )
-      break;
+while(fgets(CS buffer, MIME_MAX_LINE_LENGTH, mime_stream) != NULL)
+  {
+  if (boundary != NULL
+     && Ustrncmp(buffer, "--", 2) == 0
+     && Ustrncmp((buffer+2), boundary, Ustrlen(boundary)) == 0
+     )
+    break;


-    len = Ustrlen(buffer);
-    if (fwrite(buffer, 1, (size_t)len, out) < len)
-      return -1;
-    size += len;
-    } /* while */
-  return size;
+  len = Ustrlen(buffer);
+  if (fwrite(buffer, 1, (size_t)len, out) < len)
+    return -1;
+  size += len;
+  } /* while */
+return size;
 }



@@ -399,6 +399,7 @@ return c == EOF || num_copied == 1 ? 0 : 1;
}


+/* reset all per-part mime variables */
static void
mime_vars_reset(void)
{
@@ -725,9 +726,8 @@ while(1)
if (rc != OK) break;

   /* If we have a multipart entity and a boundary, go recursive */
-  if ( (mime_content_type != NULL) &&
-       (nested_context.boundary != NULL) &&
-       (Ustrncmp(mime_content_type,"multipart",9) == 0) )
+  if (  mime_content_type && nested_context.boundary 
+     && Ustrncmp(mime_content_type,"multipart",9) == 0)
     {
     DEBUG(D_acl)
       debug_printf_indent("MIME: Entering multipart recursion, boundary '%s'\n",
@@ -744,25 +744,25 @@ while(1)
     rc = mime_acl_check(acl, f, &nested_context, user_msgptr, log_msgptr);
     if (rc != OK) break;
     }
-  else if ( (mime_content_type != NULL) &&
-      (Ustrncmp(mime_content_type,"message/rfc822",14) == 0) )
+  else if (  mime_content_type
+      && Ustrncmp(mime_content_type,"message/rfc822",14) == 0)
     {
-    const uschar *rfc822name = NULL;
-    uschar filename[2048];
+    const uschar * rfc822name = NULL;
+    uschar * filename;
     int file_nr = 0;
     int result = 0;


     /* must find first free sequential filename */
-    do
+    for (gstring * g = string_get(64); result != -1; g->ptr = 0)
       {
       struct stat mystat;
-      (void)string_format(filename, 2048,
+      g = string_fmt_append(g,
     "%s/scan/%s/__rfc822_%05u", spool_directory, message_id, file_nr++);
       /* security break */
       if (file_nr >= 128)
     goto NO_RFC822;
-      result = stat(CS filename,&mystat);
-      } while (result != -1);
+      result = stat(CS (filename = string_from_gstring(g)), &mystat);
+      }


     rfc822name = filename;


diff --git a/src/src/receive.c b/src/src/receive.c
index 96a48fe..6d20a5c 100644
--- a/src/src/receive.c
+++ b/src/src/receive.c
@@ -1399,6 +1399,7 @@ for (header_line * my_headerlist = header_list; my_headerlist;
     goto DO_MIME_ACL;
     }


+mime_part_count = -1;
DEBUG(D_receive) debug_printf("No Content-Type: header - presumably not a MIME message.\n");
return TRUE;

@@ -1756,6 +1757,13 @@ if (thismessage_size_limit <= 0) thismessage_size_limit = INT_MAX;
message_linecount = body_linecount = body_zerocount =
max_received_linelength = 0;

+#ifdef WITH_CONTENT_SCAN
+/* reset non-per-part mime variables */
+mime_is_coverletter    = 0;
+mime_is_rfc822         = 0;
+mime_part_count        = -1;
+#endif
+
 #ifndef DISABLE_DKIM
 /* Call into DKIM to set up the context.  In CHUNKING mode
 we clear the dot-stuffing flag */
diff --git a/src/src/string.c b/src/src/string.c
index fbdc024..9f1aeb8 100644
--- a/src/src/string.c
+++ b/src/src/string.c
@@ -1256,9 +1256,23 @@ g->s = s;


/* Build or append to a growing-string, sprintf-style.

+Arguments:
+    g    a growable-string
+    func    called-from function name, for debug
+    line    called-from file line number, for debug
+    limit    maximum string size
+    flags    see below
+    format    printf-like format string
+    ap    variable-args pointer
+
+Flags:
+    SVFMT_EXTEND            buffer can be created or exteded as needed
+    SVFMT_REBUFFER          buffer can be recopied to tainted mem as needed
+    SVFMT_TAINT_NOCHK       do not check inputs for taint
+
 If the "extend" flag is true, the string passed in can be NULL,
 empty, or non-empty.  Growing is subject to an overall limit given
-by the size_limit argument.
+by the limit argument.


If the "extend" flag is false, the string passed in may not be NULL,
will not be grown, and is usable in the original place after return.
diff --git a/test/confs/4001 b/test/confs/4001
index cf124ec..856beb1 100644
--- a/test/confs/4001
+++ b/test/confs/4001
@@ -1,53 +1,25 @@
-# Exim test configuration 4001: ACL regex=
+# Exim test configuration 4001: multiple messages in connection

.include DIR/aux-var/std_conf_prefix

primary_hostname = myhost.test.ex
-rfc1413_query_timeout = 0s
-
+queue_only

# ----- Main settings -----

-acl_smtp_rcpt = check_rcpt
-acl_smtp_data = check_data
-acl_not_smtp  = check_data
-
+acl_smtp_rcpt = accept
+acl_smtp_mime = check_mime
+acl_smtp_data =    check_data


# ----- ACL -----

begin acl

-check_rcpt:
-  accept
+check_mime:
+  accept    decode  = default
+        logwrite = mime_acl: mime_part_count $mime_part_count


 check_data:
-  warn     regex   = \N(THIS\s((\w+)\s)?REGEX)\N
-           message = X-Regex: Regex matched <$regex1> <$regex3>
-
-  warn     condition = ${if !eq{$h_fakereject:}{}}
-           control   = fakereject
-
-  warn     condition = ${if !eq{$h_fakedefer:}{}}
-           control   = fakedefer
-
-  accept
-
-# ----- Routers -----
-
-begin routers
-
-r1:
-  driver = accept
-  transport = t1
-
-# ----- Transports -----
-
-begin transports
-
-t1:
-  driver = appendfile
-  file = DIR/test-mail/${bless:$local_part}
-  user = CALLER
-
+  accept    logwrite = mime_acl: mime_part_count $mime_part_count


# End
diff --git a/test/confs/4002 b/test/confs/4002
index 043a1ec..cf124ec 100644
--- a/test/confs/4002
+++ b/test/confs/4002
@@ -1,38 +1,53 @@
-# Exim test configuration 4002
-# Content-scan: spamassassin interface
-
-OPT= 127.0.0.1 7833
+# Exim test configuration 4001: ACL regex=

.include DIR/aux-var/std_conf_prefix

-log_selector = +subject
primary_hostname = myhost.test.ex
+rfc1413_query_timeout = 0s

-# we need to set the sender
-trusted_users = CALLER
-
-spamd_address = OPT

# ----- Main settings -----

-acl_smtp_rcpt = accept
-acl_smtp_data = c_data
+acl_smtp_rcpt = check_rcpt
+acl_smtp_data = check_data
+acl_not_smtp = check_data
+
+
+# ----- ACL -----

begin acl

-c_data:
-  warn
-    spam = nobody
-  warn
-    log_message = $callout_address $spam_action $spam_report
+check_rcpt:
+  accept
+
+check_data:
+  warn     regex   = \N(THIS\s((\w+)\s)?REGEX)\N
+           message = X-Regex: Regex matched <$regex1> <$regex3>
+
+  warn     condition = ${if !eq{$h_fakereject:}{}}
+           control   = fakereject
+
+  warn     condition = ${if !eq{$h_fakedefer:}{}}
+           control   = fakedefer
+
   accept


# ----- Routers -----

begin routers

-r:
- driver = redirect
- data = :blackhole:
+r1:
+ driver = accept
+ transport = t1
+
+# ----- Transports -----
+
+begin transports
+
+t1:
+ driver = appendfile
+ file = DIR/test-mail/${bless:$local_part}
+ user = CALLER
+

# End
diff --git a/test/confs/4003 b/test/confs/4003
index 1d00cc6..043a1ec 100644
--- a/test/confs/4003
+++ b/test/confs/4003
@@ -1,12 +1,17 @@
-# Exim test configuration 4003
-# Content-scan: rspamd interface
+# Exim test configuration 4002
+# Content-scan: spamassassin interface
+
+OPT= 127.0.0.1 7833

.include DIR/aux-var/std_conf_prefix

log_selector = +subject
primary_hostname = myhost.test.ex

-spamd_address = 127.0.0.1 11333 variant=rspamd
+# we need to set the sender
+trusted_users = CALLER
+
+spamd_address = OPT

# ----- Main settings -----

@@ -19,7 +24,7 @@ c_data:
   warn
     spam = nobody
   warn
-    log_message = $spam_action $spam_report
+    log_message = $callout_address $spam_action $spam_report
   accept


 # ----- Routers -----
diff --git a/test/confs/4003 b/test/confs/4004
similarity index 100%
copy from test/confs/4003
copy to test/confs/4004
diff --git a/test/confs/4015 b/test/confs/4015
deleted file mode 120000
index 4a5de23..0000000
--- a/test/confs/4015
+++ /dev/null
@@ -1 +0,0 @@
-4002
\ No newline at end of file
diff --git a/test/confs/4015 b/test/confs/4015
new file mode 100644
index 0000000..043a1ec
--- /dev/null
+++ b/test/confs/4015
@@ -0,0 +1,38 @@
+# Exim test configuration 4002
+# Content-scan: spamassassin interface
+
+OPT= 127.0.0.1 7833
+
+.include DIR/aux-var/std_conf_prefix
+
+log_selector = +subject
+primary_hostname = myhost.test.ex
+
+# we need to set the sender
+trusted_users = CALLER
+
+spamd_address = OPT
+
+# ----- Main settings -----
+
+acl_smtp_rcpt = accept
+acl_smtp_data = c_data
+
+begin acl
+
+c_data:
+  warn
+    spam = nobody
+  warn
+    log_message = $callout_address $spam_action $spam_report
+  accept
+
+# ----- Routers -----
+
+begin routers
+
+r:
+  driver = redirect
+  data = :blackhole:
+
+# End
diff --git a/test/log/4001 b/test/log/4001
deleted file mode 100644
index c1176fe..0000000
--- a/test/log/4001
+++ /dev/null
@@ -1,6 +0,0 @@
-1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@??? U=CALLER P=local-esmtp S=sss id=41C2F849.3060203@???
-1999-03-02 09:44:33 10HmaX-0005vi-00 => userx <userx@???> R=r1 T=t1
-1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaY-0005vi-00 (= CALLER@??? U=CALLER P=local-esmtp S=sss id=41C2F849.3060203@???
-1999-03-02 09:44:33 10HmaY-0005vi-00 => userx <userx@???> R=r1 T=t1
-1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
diff --git a/test/log/4002 b/test/log/4002
index 32535f5..c1176fe 100644
--- a/test/log/4002
+++ b/test/log/4002
@@ -1,17 +1,6 @@
-1999-03-02 09:44:33 10HmaX-0005vi-00 U=fromuser Warning: [127.0.0.1]:1111 no action Spam detection software, running on the system "demo",\n has NOT identified this incoming email as spam.  The original\n message has been attached to this so you can view it or label\n similar future email.  If you have any questions, see\n @@CONTACT_ADDRESS@@ for details.\n \n Content preview:  test [...]\n \n Content analysis details:   (4.5 points, 5.0 required)\n \n  pts rule name              description\n ---- ---------------------- --------------------------------------------------\n -1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP\n  1.2 MISSING_HEADERS        Missing To: header\n  1.0 MISSING_FROM           Missing From: header\n  1.8 MISSING_SUBJECT        Missing Subject: header\n  1.4 MISSING_DATE           Missing Date: header\n  0.1 MISSING_MID            Missing Message-Id: header
-1999-03-02 09:44:33 10HmaX-0005vi-00 <= fromuser@??? U=fromuser P=local-esmtp S=sss
-1999-03-02 09:44:33 10HmaX-0005vi-00 => :blackhole: <userx@???> R=r
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@??? U=CALLER P=local-esmtp S=sss id=41C2F849.3060203@???
+1999-03-02 09:44:33 10HmaX-0005vi-00 => userx <userx@???> R=r1 T=t1
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaY-0005vi-00 U=fromuser Warning: [127.0.0.1]:1111 no action Spam detection software, running on the system "demo",\n has NOT identified this incoming email as spam.  The original\n message has been attached to this so you can view it or label\n similar future email.  If you have any questions, see\n @@CONTACT_ADDRESS@@ for details.\n \n Content preview:  test [...]\n \n Content analysis details:   (4.5 points, 5.0 required)\n \n  pts rule name              description\n ---- ---------------------- --------------------------------------------------\n -1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP\n  1.2 MISSING_HEADERS        Missing To: header\n  1.0 MISSING_FROM           Missing From: header\n  1.8 MISSING_SUBJECT        Missing Subject: header\n  1.4 MISSING_DATE           Missing Date: header\n  0.1 MISSING_MID            Missing Message-Id: header
-1999-03-02 09:44:33 10HmaY-0005vi-00 <= fromuser@??? U=fromuser P=local-esmtp S=sss
-1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <userx@???> R=r
+1999-03-02 09:44:33 10HmaY-0005vi-00 (= CALLER@??? U=CALLER P=local-esmtp S=sss id=41C2F849.3060203@???
+1999-03-02 09:44:33 10HmaY-0005vi-00 => userx <userx@???> R=r1 T=t1
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaZ-0005vi-00 U=fromuser Warning: [127.0.0.1]:1111 no action Spam detection software, running on the system "demo",\n has NOT identified this incoming email as spam.  The original\n message has been attached to this so you can view it or label\n similar future email.  If you have any questions, see\n @@CONTACT_ADDRESS@@ for details.\n \n Content preview:  test [...]\n \n Content analysis details:   (4.5 points, 5.0 required)\n \n  pts rule name              description\n ---- ---------------------- --------------------------------------------------\n -1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP\n  1.2 MISSING_HEADERS        Missing To: header\n  1.0 MISSING_FROM           Missing From: header\n  1.8 MISSING_SUBJECT        Missing Subject: header\n  1.4 MISSING_DATE           Missing Date: header\n  0.1 MISSING_MID            Missing Message-Id: header
-1999-03-02 09:44:33 10HmaZ-0005vi-00 <= fromuser@??? U=fromuser P=local-esmtp S=sss
-1999-03-02 09:44:33 10HmaZ-0005vi-00 => :blackhole: <userx@???> R=r
-1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
-1999-03-02 09:44:33 10HmbA-0005vi-00 spam acl condition: spamd: failed to connect to any address for ip4.ip4.ip4.ip4: Connection refused
-1999-03-02 09:44:33 10HmbA-0005vi-00 U=fromuser Warning: [127.0.0.1]:1111 no action Spam detection software, running on the system "demo",\n has NOT identified this incoming email as spam.  The original\n message has been attached to this so you can view it or label\n similar future email.  If you have any questions, see\n @@CONTACT_ADDRESS@@ for details.\n \n Content preview:  test [...]\n \n Content analysis details:   (4.5 points, 5.0 required)\n \n  pts rule name              description\n ---- ---------------------- --------------------------------------------------\n -1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP\n  1.2 MISSING_HEADERS        Missing To: header\n  1.0 MISSING_FROM           Missing From: header\n  1.8 MISSING_SUBJECT        Missing Subject: header\n  1.4 MISSING_DATE           Missing Date: header\n  0.1 MISSING_MID            Missing Message-Id: header
-1999-03-02 09:44:33 10HmbA-0005vi-00 <= fromuser@??? U=fromuser P=local-esmtp S=sss
-1999-03-02 09:44:33 10HmbA-0005vi-00 => :blackhole: <userx@???> R=r
-1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
diff --git a/test/log/4003 b/test/log/4003
index d8bbb9b..32535f5 100644
--- a/test/log/4003
+++ b/test/log/4003
@@ -1,4 +1,17 @@
-1999-03-02 09:44:33 10HmaX-0005vi-00 U=CALLER Warning: reject Action: reject\n Symbol: FAKE_SYMBOL_A(15.00)\n Symbol: FAKE_SYMBOL_B(0.00)\n Message-ID: undef
-1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@??? U=CALLER P=local-esmtp S=sss
+1999-03-02 09:44:33 10HmaX-0005vi-00 U=fromuser Warning: [127.0.0.1]:1111 no action Spam detection software, running on the system "demo",\n has NOT identified this incoming email as spam.  The original\n message has been attached to this so you can view it or label\n similar future email.  If you have any questions, see\n @@CONTACT_ADDRESS@@ for details.\n \n Content preview:  test [...]\n \n Content analysis details:   (4.5 points, 5.0 required)\n \n  pts rule name              description\n ---- ---------------------- --------------------------------------------------\n -1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP\n  1.2 MISSING_HEADERS        Missing To: header\n  1.0 MISSING_FROM           Missing From: header\n  1.8 MISSING_SUBJECT        Missing Subject: header\n  1.4 MISSING_DATE           Missing Date: header\n  0.1 MISSING_MID            Missing Message-Id: header
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= fromuser@??? U=fromuser P=local-esmtp S=sss
 1999-03-02 09:44:33 10HmaX-0005vi-00 => :blackhole: <userx@???> R=r
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaY-0005vi-00 U=fromuser Warning: [127.0.0.1]:1111 no action Spam detection software, running on the system "demo",\n has NOT identified this incoming email as spam.  The original\n message has been attached to this so you can view it or label\n similar future email.  If you have any questions, see\n @@CONTACT_ADDRESS@@ for details.\n \n Content preview:  test [...]\n \n Content analysis details:   (4.5 points, 5.0 required)\n \n  pts rule name              description\n ---- ---------------------- --------------------------------------------------\n -1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP\n  1.2 MISSING_HEADERS        Missing To: header\n  1.0 MISSING_FROM           Missing From: header\n  1.8 MISSING_SUBJECT        Missing Subject: header\n  1.4 MISSING_DATE           Missing Date: header\n  0.1 MISSING_MID            Missing Message-Id: header
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= fromuser@??? U=fromuser P=local-esmtp S=sss
+1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <userx@???> R=r
+1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaZ-0005vi-00 U=fromuser Warning: [127.0.0.1]:1111 no action Spam detection software, running on the system "demo",\n has NOT identified this incoming email as spam.  The original\n message has been attached to this so you can view it or label\n similar future email.  If you have any questions, see\n @@CONTACT_ADDRESS@@ for details.\n \n Content preview:  test [...]\n \n Content analysis details:   (4.5 points, 5.0 required)\n \n  pts rule name              description\n ---- ---------------------- --------------------------------------------------\n -1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP\n  1.2 MISSING_HEADERS        Missing To: header\n  1.0 MISSING_FROM           Missing From: header\n  1.8 MISSING_SUBJECT        Missing Subject: header\n  1.4 MISSING_DATE           Missing Date: header\n  0.1 MISSING_MID            Missing Message-Id: header
+1999-03-02 09:44:33 10HmaZ-0005vi-00 <= fromuser@??? U=fromuser P=local-esmtp S=sss
+1999-03-02 09:44:33 10HmaZ-0005vi-00 => :blackhole: <userx@???> R=r
+1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbA-0005vi-00 spam acl condition: spamd: failed to connect to any address for ip4.ip4.ip4.ip4: Connection refused
+1999-03-02 09:44:33 10HmbA-0005vi-00 U=fromuser Warning: [127.0.0.1]:1111 no action Spam detection software, running on the system "demo",\n has NOT identified this incoming email as spam.  The original\n message has been attached to this so you can view it or label\n similar future email.  If you have any questions, see\n @@CONTACT_ADDRESS@@ for details.\n \n Content preview:  test [...]\n \n Content analysis details:   (4.5 points, 5.0 required)\n \n  pts rule name              description\n ---- ---------------------- --------------------------------------------------\n -1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP\n  1.2 MISSING_HEADERS        Missing To: header\n  1.0 MISSING_FROM           Missing From: header\n  1.8 MISSING_SUBJECT        Missing Subject: header\n  1.4 MISSING_DATE           Missing Date: header\n  0.1 MISSING_MID            Missing Message-Id: header
+1999-03-02 09:44:33 10HmbA-0005vi-00 <= fromuser@??? U=fromuser P=local-esmtp S=sss
+1999-03-02 09:44:33 10HmbA-0005vi-00 => :blackhole: <userx@???> R=r
+1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
diff --git a/test/log/4003 b/test/log/4004
similarity index 100%
copy from test/log/4003
copy to test/log/4004
diff --git a/test/mail/4001.userx b/test/mail/4002.userx
similarity index 100%
rename from test/mail/4001.userx
rename to test/mail/4002.userx
diff --git a/test/runtest b/test/runtest
index e914ccb..994ff9f 100755
--- a/test/runtest
+++ b/test/runtest
@@ -1210,6 +1210,9 @@ RESET_AFTER_EXTRA_LINE_READ:
     # timing variance, run-to-run
     s/^time on queue = \K1s/0s/;


+    # content-scan: file order can vary in directory
+    s%unspool_mbox\(\): unlinking 'TESTSUITE/spool/scan/[^/]*/\K[^\']*%FFFFFFFFF%;
+
     # Skip hosts_require_dane checks when the options
     # are unset, because dane ain't always there.
     next if /in\shosts_require_dane\?\sno\s\(option\sunset\)/x;
diff --git a/test/scripts/4000-scanning/4001 b/test/scripts/4000-scanning/4001
index a660f68..060e4d1 100644
--- a/test/scripts/4000-scanning/4001
+++ b/test/scripts/4000-scanning/4001
@@ -1,38 +1,72 @@
-# ACL regex= test
-#
-# These tests are copies from testcase 4000;
-# they should be removed from there but I don't
-# run spamassassin so can't verify the change.
-#
-exim -odi -bs
-ehlo test.ex
-mail from:<>
-rcpt to:<userx@???>
-data
-From: Test person <tp@???>
-To: Me <userx@???>
-Subject: A real test message
-Date: Fri, 17 Dec 2004 16:13:04 +0100
-Message-ID: <41C2F849.3060203@???>
-
-OK, this should look like a genuine message.
+# multiple messages in connection
+
+exim -bh 127.0.0.1
+EHLO mailserver.test
+MAIL FROM:<sender@???>
+RCPT TO:<heiko@???>
+DATA
+From: sender@???
+To: heiko@???
+Subject: test no attachment
+
+This is a test mailing
+
 .
-quit
-****
-exim -odi -bs
-ehlo test.ex
-mail from:<>
-rcpt to:<userx@???>
-data
-From: Test person <tp@???>
-To: Me <userx@???>
-Subject: A real test message
-Date: Fri, 17 Dec 2004 16:13:04 +0100
-Message-ID: <41C2F849.3060203@???>
-FakeReject: test fakereject
-
-OK, this should look like a genuine message, but
-it will trip on THIS gazornenplaz REGEX.
+MAIL FROM:<sender@???>
+RCPT TO:<heiko@???>
+DATA
+From: sender@???
+To: heiko@???
+Subject: test with attachment
+MIME-Version: 1.0
+Content-Type: multipart/mixed; boundary="----=_MIME_BOUNDARY_000_431036"
+
+------=_MIME_BOUNDARY_000_431036
+Content-Type: text/plain
+
+This is a test mailing
+------=_MIME_BOUNDARY_000_431036
+Content-Type: application/octet-stream
+Content-Disposition: attachment
+Content-Transfer-Encoding: BASE64
+
+U2F0IEZlYiAyOSAxNDo1ODowMyBDRVQgMjAyMAo=
+
+------=_MIME_BOUNDARY_000_431036--
+
+.
+MAIL FROM:<sender@???>
+RCPT TO:<heiko@???>
+DATA
+From: sender@???
+To: heiko@???
+Subject: test with attachment
+MIME-Version: 1.0
+Content-Type: multipart/mixed; boundary="----=_MIME_BOUNDARY_000_431036"
+
+------=_MIME_BOUNDARY_000_431036
+Content-Type: text/plain
+
+This is a test mailing
+------=_MIME_BOUNDARY_000_431036
+Content-Type: application/octet-stream
+Content-Disposition: attachment
+Content-Transfer-Encoding: BASE64
+
+U2F0IEZlYiAyOSAxNDo1ODowMyBDRVQgMjAyMAo=
+
+------=_MIME_BOUNDARY_000_431036--
+
+.
+MAIL FROM:<sender@???>
+RCPT TO:<heiko@???>
+DATA
+From: sender@???
+To: heiko@???
+Subject: test no attachment
+
+This is a test mailing ($(date "+%F %T"))
+
 .
-quit
+QUIT
 ****
diff --git a/test/scripts/4000-scanning/4002 b/test/scripts/4000-scanning/4002
index d9849c3..a660f68 100644
--- a/test/scripts/4000-scanning/4002
+++ b/test/scripts/4000-scanning/4002
@@ -1,242 +1,38 @@
-# content scan interface: spamassassin
+# ACL regex= test
 #
-# The spooled file for scanning includes the test-runner's user name
-# hence size varies.  Munge that.
-munge scanfile_size
+# These tests are copies from testcase 4000;
+# they should be removed from there but I don't
+# run spamassassin so can't verify the change.
 #
-#
-# A good-comms test, returning not-spam.
-# (we could use a second one that returns is-spam...)
-server 7833
-<REPORT SPAMC
-<User:
-<Content-length:
-<
-<From
-<X-Envelope-From
-<X-Envelope-To
-<Received:
-<    by
-<    (envelope
-<    id
-<    for
-<Content-type: text/plain
-<Message-Id:
-<From:
-<Date:
-<
-<test
->SPAMD/1.1 0 EX_OK
->Spam: False ; 4.5 / 5.0
->
->Spam detection software, running on the system "demo",
->has NOT identified this incoming email as spam.  The original
->message has been attached to this so you can view it or label
->similar future email.  If you have any questions, see
->@@CONTACT_ADDRESS@@ for details.
->
->Content preview:  test [...]
->
->Content analysis details:   (4.5 points, 5.0 required)
->
-> pts rule name              description
->---- ---------------------- --------------------------------------------------
->-1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP
-> 1.2 MISSING_HEADERS        Missing To: header
-> 1.0 MISSING_FROM           Missing From: header
-> 1.8 MISSING_SUBJECT        Missing Subject: header
-> 1.4 MISSING_DATE           Missing Date: header
-> 0.1 MISSING_MID            Missing Message-Id: header
->
-*eof
-****
-exim -odi -oMt fromuser -bs
+exim -odi -bs
 ehlo test.ex
-mail from:<fromuser@???>
+mail from:<>
 rcpt to:<userx@???>
 data
-Content-type: text/plain
+From: Test person <tp@???>
+To: Me <userx@???>
+Subject: A real test message
+Date: Fri, 17 Dec 2004 16:13:04 +0100
+Message-ID: <41C2F849.3060203@???>


-test
+OK, this should look like a genuine message.
 .
 quit
 ****
-#
-#
-#
-#
-# Server spec line with timeout option, not exercised
-# (could we cut down the massive content?)
-server 7833
-<REPORT SPAMC
-<User:
-<Content-length:
-<
-<From
-<X-Envelope-From
-<X-Envelope-To
-<Received:
-<    by
-<    (envelope
-<    id
-<    for
-<Content-type: text/plain
-<Message-Id:
-<From:
-<Date:
-<
-<test
->SPAMD/1.1 0 EX_OK
->Spam: False ; 4.5 / 5.0
->
->Spam detection software, running on the system "demo",
->has NOT identified this incoming email as spam.  The original
->message has been attached to this so you can view it or label
->similar future email.  If you have any questions, see
->@@CONTACT_ADDRESS@@ for details.
->
->Content preview:  test [...]
->
->Content analysis details:   (4.5 points, 5.0 required)
->
-> pts rule name              description
->---- ---------------------- --------------------------------------------------
->-1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP
-> 1.2 MISSING_HEADERS        Missing To: header
-> 1.0 MISSING_FROM           Missing From: header
-> 1.8 MISSING_SUBJECT        Missing Subject: header
-> 1.4 MISSING_DATE           Missing Date: header
-> 0.1 MISSING_MID            Missing Message-Id: header
->
-*eof
-****
-exim -odi -oMt fromuser -bs -DOPT='127.0.0.1 7833 retry=10s'
+exim -odi -bs
 ehlo test.ex
-mail from:<fromuser@???>
+mail from:<>
 rcpt to:<userx@???>
 data
-Content-type: text/plain
+From: Test person <tp@???>
+To: Me <userx@???>
+Subject: A real test message
+Date: Fri, 17 Dec 2004 16:13:04 +0100
+Message-ID: <41C2F849.3060203@???>
+FakeReject: test fakereject


-test
+OK, this should look like a genuine message, but
+it will trip on THIS gazornenplaz REGEX.
 .
 quit
 ****
-#
-#
-#
-# Server spec line with timeout option, exercised
-server -i 2 7833
-<REPORT SPAMC
-<User:
-<Content-length:
-<
-<From
-<X-Envelope-From
-<X-Envelope-To
-<Received:
-<    by
-<    (envelope
-<    id
-<    for
-<Content-type: text/plain
-<Message-Id:
-<From:
-<Date:
-<
-<test
->SPAMD/1.1 0 EX_OK
->Spam: False ; 4.5 / 5.0
->
->Spam detection software, running on the system "demo",
->has NOT identified this incoming email as spam.  The original
->message has been attached to this so you can view it or label
->similar future email.  If you have any questions, see
->@@CONTACT_ADDRESS@@ for details.
->
->Content preview:  test [...]
->
->Content analysis details:   (4.5 points, 5.0 required)
->
-> pts rule name              description
->---- ---------------------- --------------------------------------------------
->-1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP
-> 1.2 MISSING_HEADERS        Missing To: header
-> 1.0 MISSING_FROM           Missing From: header
-> 1.8 MISSING_SUBJECT        Missing Subject: header
-> 1.4 MISSING_DATE           Missing Date: header
-> 0.1 MISSING_MID            Missing Message-Id: header
->
-*eof
-****
-exim -odi -oMt fromuser -bs -DOPT='127.0.0.1 7833 retry=4s'
-ehlo test.ex
-mail from:<fromuser@???>
-rcpt to:<userx@???>
-data
-Content-type: text/plain
-
-test
-.
-quit
-****
-#
-#
-#
-# Multiple servers, prioritised, with timeout spec; first one fails
-# List separator changed
-server 7833
-<REPORT SPAMC
-<User:
-<Content-length:
-<
-<From
-<X-Envelope-From
-<X-Envelope-To
-<Received:
-<    by
-<    (envelope
-<    id
-<    for
-<Content-type: text/plain
-<Message-Id:
-<From:
-<Date:
-<
-<test
->SPAMD/1.1 0 EX_OK
->Spam: False ; 4.5 / 5.0
->
->Spam detection software, running on the system "demo",
->has NOT identified this incoming email as spam.  The original
->message has been attached to this so you can view it or label
->similar future email.  If you have any questions, see
->@@CONTACT_ADDRESS@@ for details.
->
->Content preview:  test [...]
->
->Content analysis details:   (4.5 points, 5.0 required)
->
-> pts rule name              description
->---- ---------------------- --------------------------------------------------
->-1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP
-> 1.2 MISSING_HEADERS        Missing To: header
-> 1.0 MISSING_FROM           Missing From: header
-> 1.8 MISSING_SUBJECT        Missing Subject: header
-> 1.4 MISSING_DATE           Missing Date: header
-> 0.1 MISSING_MID            Missing Message-Id: header
->
-*eof
-****
-exim -odi -oMt fromuser -bs -DOPT='<; 127.0.0.1 7833 ; HOSTIPV4 7834 pri=2 tmo=2s'
-ehlo test.ex
-mail from:<fromuser@???>
-rcpt to:<userx@???>
-data
-Content-type: text/plain
-
-test
-.
-quit
-****
-#
-#
diff --git a/test/scripts/4000-scanning/4003 b/test/scripts/4000-scanning/4003
index e5a7c94..d9849c3 100644
--- a/test/scripts/4000-scanning/4003
+++ b/test/scripts/4000-scanning/4003
@@ -1,18 +1,134 @@
-# content scan interface: rspamd
+# content scan interface: spamassassin
 #
 # The spooled file for scanning includes the test-runner's user name
 # hence size varies.  Munge that.
 munge scanfile_size
 #
-server 11333
-<CHECK RSPAMC/1.3
+#
+# A good-comms test, returning not-spam.
+# (we could use a second one that returns is-spam...)
+server 7833
+<REPORT SPAMC
+<User:
+<Content-length:
+<
+<From
+<X-Envelope-From
+<X-Envelope-To
+<Received:
+<    by
+<    (envelope
+<    id
+<    for
+<Content-type: text/plain
+<Message-Id:
+<From:
+<Date:
+<
+<test
+>SPAMD/1.1 0 EX_OK
+>Spam: False ; 4.5 / 5.0
+>
+>Spam detection software, running on the system "demo",
+>has NOT identified this incoming email as spam.  The original
+>message has been attached to this so you can view it or label
+>similar future email.  If you have any questions, see
+>@@CONTACT_ADDRESS@@ for details.
+>
+>Content preview:  test [...]
+>
+>Content analysis details:   (4.5 points, 5.0 required)
+>
+> pts rule name              description
+>---- ---------------------- --------------------------------------------------
+>-1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP
+> 1.2 MISSING_HEADERS        Missing To: header
+> 1.0 MISSING_FROM           Missing From: header
+> 1.8 MISSING_SUBJECT        Missing Subject: header
+> 1.4 MISSING_DATE           Missing Date: header
+> 0.1 MISSING_MID            Missing Message-Id: header
+>
+*eof
+****
+exim -odi -oMt fromuser -bs
+ehlo test.ex
+mail from:<fromuser@???>
+rcpt to:<userx@???>
+data
+Content-type: text/plain
+
+test
+.
+quit
+****
+#
+#
+#
+#
+# Server spec line with timeout option, not exercised
+# (could we cut down the massive content?)
+server 7833
+<REPORT SPAMC
+<User:
 <Content-length:
-<Queue-Id:
+<
+<From
+<X-Envelope-From
+<X-Envelope-To
+<Received:
+<    by
+<    (envelope
+<    id
+<    for
+<Content-type: text/plain
+<Message-Id:
 <From:
-<Recipient-Number: 1
-<Rcpt:
-<Helo:
+<Date:
+<
+<test
+>SPAMD/1.1 0 EX_OK
+>Spam: False ; 4.5 / 5.0
+>
+>Spam detection software, running on the system "demo",
+>has NOT identified this incoming email as spam.  The original
+>message has been attached to this so you can view it or label
+>similar future email.  If you have any questions, see
+>@@CONTACT_ADDRESS@@ for details.
+>
+>Content preview:  test [...]
+>
+>Content analysis details:   (4.5 points, 5.0 required)
+>
+> pts rule name              description
+>---- ---------------------- --------------------------------------------------
+>-1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP
+> 1.2 MISSING_HEADERS        Missing To: header
+> 1.0 MISSING_FROM           Missing From: header
+> 1.8 MISSING_SUBJECT        Missing Subject: header
+> 1.4 MISSING_DATE           Missing Date: header
+> 0.1 MISSING_MID            Missing Message-Id: header
+>
+*eof
+****
+exim -odi -oMt fromuser -bs -DOPT='127.0.0.1 7833 retry=10s'
+ehlo test.ex
+mail from:<fromuser@???>
+rcpt to:<userx@???>
+data
+Content-type: text/plain
+
+test
+.
+quit
+****
+#
+#
+#
+# Server spec line with timeout option, exercised
+server -i 2 7833
+<REPORT SPAMC
 <User:
+<Content-length:
 <
 <From
 <X-Envelope-From
@@ -22,30 +138,105 @@ server 11333
 <    (envelope
 <    id
 <    for
+<Content-type: text/plain
+<Message-Id:
 <From:
+<Date:
+<
+<test
+>SPAMD/1.1 0 EX_OK
+>Spam: False ; 4.5 / 5.0
+>
+>Spam detection software, running on the system "demo",
+>has NOT identified this incoming email as spam.  The original
+>message has been attached to this so you can view it or label
+>similar future email.  If you have any questions, see
+>@@CONTACT_ADDRESS@@ for details.
+>
+>Content preview:  test [...]
+>
+>Content analysis details:   (4.5 points, 5.0 required)
+>
+> pts rule name              description
+>---- ---------------------- --------------------------------------------------
+>-1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP
+> 1.2 MISSING_HEADERS        Missing To: header
+> 1.0 MISSING_FROM           Missing From: header
+> 1.8 MISSING_SUBJECT        Missing Subject: header
+> 1.4 MISSING_DATE           Missing Date: header
+> 0.1 MISSING_MID            Missing Message-Id: header
+>
+*eof
+****
+exim -odi -oMt fromuser -bs -DOPT='127.0.0.1 7833 retry=4s'
+ehlo test.ex
+mail from:<fromuser@???>
+rcpt to:<userx@???>
+data
+Content-type: text/plain
+
+test
+.
+quit
+****
+#
+#
+#
+# Multiple servers, prioritised, with timeout spec; first one fails
+# List separator changed
+server 7833
+<REPORT SPAMC
+<User:
+<Content-length:
+<
+<From
+<X-Envelope-From
+<X-Envelope-To
+<Received:
+<    by
+<    (envelope
+<    id
+<    for
 <Content-type: text/plain
 <Message-Id:
-<Sender:
+<From:
 <Date:
 <
 <test
->RSPAMD/1.3 0 EX_OK
->Metric: default; True; 15.00 / 15.00 / 0.0
->Action: reject
->Symbol: FAKE_SYMBOL_A(15.00)
->Symbol: FAKE_SYMBOL_B(0.00)
->Message-ID: undef
+>SPAMD/1.1 0 EX_OK
+>Spam: False ; 4.5 / 5.0
+>
+>Spam detection software, running on the system "demo",
+>has NOT identified this incoming email as spam.  The original
+>message has been attached to this so you can view it or label
+>similar future email.  If you have any questions, see
+>@@CONTACT_ADDRESS@@ for details.
+>
+>Content preview:  test [...]
+>
+>Content analysis details:   (4.5 points, 5.0 required)
+>
+> pts rule name              description
+>---- ---------------------- --------------------------------------------------
+>-1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP
+> 1.2 MISSING_HEADERS        Missing To: header
+> 1.0 MISSING_FROM           Missing From: header
+> 1.8 MISSING_SUBJECT        Missing Subject: header
+> 1.4 MISSING_DATE           Missing Date: header
+> 0.1 MISSING_MID            Missing Message-Id: header
+>
 *eof
 ****
-exim -odi -bs
+exim -odi -oMt fromuser -bs -DOPT='<; 127.0.0.1 7833 ; HOSTIPV4 7834 pri=2 tmo=2s'
 ehlo test.ex
-mail from:<>
+mail from:<fromuser@???>
 rcpt to:<userx@???>
 data
-From: MAILER_DAEMON <>
 Content-type: text/plain


 test
 .
 quit
 ****
+#
+#
diff --git a/test/scripts/4000-scanning/4003 b/test/scripts/4000-scanning/4004
similarity index 100%
copy from test/scripts/4000-scanning/4003
copy to test/scripts/4000-scanning/4004
diff --git a/test/stderr/4001 b/test/stderr/4001
new file mode 100644
index 0000000..1873fd4
--- /dev/null
+++ b/test/stderr/4001
@@ -0,0 +1,116 @@
+>>> host in hosts_connection_nolog? no (option unset)
+>>> host in host_lookup? no (option unset)
+>>> host in host_reject_connection? no (option unset)
+>>> host in sender_unqualified_hosts? no (option unset)
+>>> host in recipient_unqualified_hosts? no (option unset)
+>>> host in helo_verify_hosts? no (option unset)
+>>> host in helo_try_verify_hosts? no (option unset)
+>>> host in helo_accept_junk_hosts? no (option unset)
+>>> mailserver.test in helo_lookup_domains? no (end of list)
+>>> host in dsn_advertise_hosts? no (option unset)
+>>> host in pipelining_advertise_hosts? yes (matched "*")
+>>> host in chunking_advertise_hosts? no (end of list)
+>>> processing "accept" (TESTSUITE/test-config 25)
+>>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
+>>> host in ignore_fromline_hosts? no (option unset)
+>>> using ACL "check_data"
+>>> processing "accept" (TESTSUITE/test-config 23)
+>>> check logwrite = mime_acl: mime_part_count $mime_part_count
+>>>                = mime_acl: mime_part_count -1
+LOG: 10HmaX-0005vi-00 mime_acl: mime_part_count -1
+>>> accept: condition test succeeded in ACL "check_data"
+>>> end of ACL "check_data": ACCEPT
+LOG: 10HmaX-0005vi-00 <= sender@??? H=(mailserver.test) [127.0.0.1] P=esmtp S=sss
+>>> processing "accept" (TESTSUITE/test-config 25)
+>>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
+>>> host in ignore_fromline_hosts? no (option unset)
+>>> using ACL "check_mime"
+>>> processing "accept" (TESTSUITE/test-config 19)
+>>> check decode = default
+>>> check logwrite = mime_acl: mime_part_count $mime_part_count
+>>>                = mime_acl: mime_part_count 0
+LOG: 10HmaY-0005vi-00 mime_acl: mime_part_count 0
+>>> accept: condition test succeeded in ACL "check_mime"
+>>> end of ACL "check_mime": ACCEPT
+>>> using ACL "check_mime"
+>>> processing "accept" (TESTSUITE/test-config 19)
+>>> check decode = default
+>>> check logwrite = mime_acl: mime_part_count $mime_part_count
+>>>                = mime_acl: mime_part_count 1
+LOG: 10HmaY-0005vi-00 mime_acl: mime_part_count 1
+>>> accept: condition test succeeded in ACL "check_mime"
+>>> end of ACL "check_mime": ACCEPT
+>>> using ACL "check_mime"
+>>> processing "accept" (TESTSUITE/test-config 19)
+>>> check decode = default
+>>> check logwrite = mime_acl: mime_part_count $mime_part_count
+>>>                = mime_acl: mime_part_count 2
+LOG: 10HmaY-0005vi-00 mime_acl: mime_part_count 2
+>>> accept: condition test succeeded in ACL "check_mime"
+>>> end of ACL "check_mime": ACCEPT
+>>> using ACL "check_data"
+>>> processing "accept" (TESTSUITE/test-config 23)
+>>> check logwrite = mime_acl: mime_part_count $mime_part_count
+>>>                = mime_acl: mime_part_count 2
+LOG: 10HmaY-0005vi-00 mime_acl: mime_part_count 2
+>>> accept: condition test succeeded in ACL "check_data"
+>>> end of ACL "check_data": ACCEPT
+>>> unspool_mbox(): unlinking 'TESTSUITE/spool/scan/10HmaY-0005vi-00/FFFFFFFFF'
+>>> unspool_mbox(): unlinking 'TESTSUITE/spool/scan/10HmaY-0005vi-00/FFFFFFFFF'
+>>> unspool_mbox(): unlinking 'TESTSUITE/spool/scan/10HmaY-0005vi-00/FFFFFFFFF'
+>>> unspool_mbox(): unlinking 'TESTSUITE/spool/scan/10HmaY-0005vi-00/FFFFFFFFF'
+LOG: 10HmaY-0005vi-00 <= sender@??? H=(mailserver.test) [127.0.0.1] P=esmtp S=sss
+>>> processing "accept" (TESTSUITE/test-config 25)
+>>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
+>>> host in ignore_fromline_hosts? no (option unset)
+>>> using ACL "check_mime"
+>>> processing "accept" (TESTSUITE/test-config 19)
+>>> check decode = default
+>>> check logwrite = mime_acl: mime_part_count $mime_part_count
+>>>                = mime_acl: mime_part_count 0
+LOG: 10HmaZ-0005vi-00 mime_acl: mime_part_count 0
+>>> accept: condition test succeeded in ACL "check_mime"
+>>> end of ACL "check_mime": ACCEPT
+>>> using ACL "check_mime"
+>>> processing "accept" (TESTSUITE/test-config 19)
+>>> check decode = default
+>>> check logwrite = mime_acl: mime_part_count $mime_part_count
+>>>                = mime_acl: mime_part_count 1
+LOG: 10HmaZ-0005vi-00 mime_acl: mime_part_count 1
+>>> accept: condition test succeeded in ACL "check_mime"
+>>> end of ACL "check_mime": ACCEPT
+>>> using ACL "check_mime"
+>>> processing "accept" (TESTSUITE/test-config 19)
+>>> check decode = default
+>>> check logwrite = mime_acl: mime_part_count $mime_part_count
+>>>                = mime_acl: mime_part_count 2
+LOG: 10HmaZ-0005vi-00 mime_acl: mime_part_count 2
+>>> accept: condition test succeeded in ACL "check_mime"
+>>> end of ACL "check_mime": ACCEPT
+>>> using ACL "check_data"
+>>> processing "accept" (TESTSUITE/test-config 23)
+>>> check logwrite = mime_acl: mime_part_count $mime_part_count
+>>>                = mime_acl: mime_part_count 2
+LOG: 10HmaZ-0005vi-00 mime_acl: mime_part_count 2
+>>> accept: condition test succeeded in ACL "check_data"
+>>> end of ACL "check_data": ACCEPT
+>>> unspool_mbox(): unlinking 'TESTSUITE/spool/scan/10HmaZ-0005vi-00/FFFFFFFFF'
+>>> unspool_mbox(): unlinking 'TESTSUITE/spool/scan/10HmaZ-0005vi-00/FFFFFFFFF'
+>>> unspool_mbox(): unlinking 'TESTSUITE/spool/scan/10HmaZ-0005vi-00/FFFFFFFFF'
+>>> unspool_mbox(): unlinking 'TESTSUITE/spool/scan/10HmaZ-0005vi-00/FFFFFFFFF'
+LOG: 10HmaZ-0005vi-00 <= sender@??? H=(mailserver.test) [127.0.0.1] P=esmtp S=sss
+>>> processing "accept" (TESTSUITE/test-config 25)
+>>> accept: condition test succeeded in inline ACL
+>>> end of inline ACL: ACCEPT
+>>> host in ignore_fromline_hosts? no (option unset)
+>>> using ACL "check_data"
+>>> processing "accept" (TESTSUITE/test-config 23)
+>>> check logwrite = mime_acl: mime_part_count $mime_part_count
+>>>                = mime_acl: mime_part_count -1
+LOG: 10HmbA-0005vi-00 mime_acl: mime_part_count -1
+>>> accept: condition test succeeded in ACL "check_data"
+>>> end of ACL "check_data": ACCEPT
+LOG: 10HmbA-0005vi-00 <= sender@??? H=(mailserver.test) [127.0.0.1] P=esmtp S=sss
diff --git a/test/stderr/4004 b/test/stderr/4004
deleted file mode 100644
index 1de0ab5..0000000
--- a/test/stderr/4004
+++ /dev/null
@@ -1,3 +0,0 @@
-1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: sophie TESTSUITE/eximdir/sophie_sock : scanner reported error
-1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: sophie TESTSUITE/eximdir/sophie_sock : unable to read from UNIX socket (TESTSUITE/eximdir/sophie_sock)
-1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: sophie TESTSUITE/eximdir/sophie_sock : unable to read from UNIX socket (TESTSUITE/eximdir/sophie_sock)
diff --git a/test/stdout/4001 b/test/stdout/4001
index 2db3157..e0e8de0 100644
--- a/test/stdout/4001
+++ b/test/stdout/4001
@@ -1,5 +1,10 @@
+
+**** SMTP testing session as if from host 127.0.0.1
+**** but without any ident (RFC 1413) callback.
+**** This is not for real!
+
 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
-250-myhost.test.ex Hello CALLER at test.ex
+250-myhost.test.ex Hello mailserver.test [127.0.0.1]
 250-SIZE 52428800
 250-8BITMIME
 250-PIPELINING
@@ -8,17 +13,28 @@
 250 Accepted
 354 Enter message, ending with "." on a line by itself
 250 OK id=10HmaX-0005vi-00
-221 myhost.test.ex closing connection
-220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
-250-myhost.test.ex Hello CALLER at test.ex
-250-SIZE 52428800
-250-8BITMIME
-250-PIPELINING
-250 HELP
+
+**** SMTP testing: that is not a real message id!
+
+250 OK
+250 Accepted
+354 Enter message, ending with "." on a line by itself
+250 OK id=10HmaY-0005vi-00
+
+**** SMTP testing: that is not a real message id!
+
+250 OK
+250 Accepted
+354 Enter message, ending with "." on a line by itself
+250 OK id=10HmaZ-0005vi-00
+
+**** SMTP testing: that is not a real message id!
+
 250 OK
 250 Accepted
 354 Enter message, ending with "." on a line by itself
-550-Your message has been rejected but is being kept for evaluation.
-550-If it was a legitimate message, it may still be delivered to the target
-550 recipient(s).
+250 OK id=10HmbA-0005vi-00
+
+**** SMTP testing: that is not a real message id!
+
 221 myhost.test.ex closing connection
diff --git a/test/stdout/4002 b/test/stdout/4002
index 5c16c63..2db3157 100644
--- a/test/stdout/4002
+++ b/test/stdout/4002
@@ -1,5 +1,5 @@
 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
-250-myhost.test.ex Hello fromuser at test.ex
+250-myhost.test.ex Hello CALLER at test.ex
 250-SIZE 52428800
 250-8BITMIME
 250-PIPELINING
@@ -10,7 +10,7 @@
 250 OK id=10HmaX-0005vi-00
 221 myhost.test.ex closing connection
 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
-250-myhost.test.ex Hello fromuser at test.ex
+250-myhost.test.ex Hello CALLER at test.ex
 250-SIZE 52428800
 250-8BITMIME
 250-PIPELINING
@@ -18,206 +18,7 @@
 250 OK
 250 Accepted
 354 Enter message, ending with "." on a line by itself
-250 OK id=10HmaY-0005vi-00
+550-Your message has been rejected but is being kept for evaluation.
+550-If it was a legitimate message, it may still be delivered to the target
+550 recipient(s).
 221 myhost.test.ex closing connection
-220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
-250-myhost.test.ex Hello fromuser at test.ex
-250-SIZE 52428800
-250-8BITMIME
-250-PIPELINING
-250 HELP
-250 OK
-250 Accepted
-354 Enter message, ending with "." on a line by itself
-250 OK id=10HmaZ-0005vi-00
-221 myhost.test.ex closing connection
-220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
-250-myhost.test.ex Hello fromuser at test.ex
-250-SIZE 52428800
-250-8BITMIME
-250-PIPELINING
-250 HELP
-250 OK
-250 Accepted
-354 Enter message, ending with "." on a line by itself
-250 OK id=10HmbA-0005vi-00
-221 myhost.test.ex closing connection
-
-******** SERVER ********
-Listening on port 7833 ... 
-Connection request from [127.0.0.1]
-<REPORT SPAMC/1.2
-<User: nobody
-<Content-length: ddd
-<
-<From MAILER-DAEMON Tue Mar 02 09:44:33 1999
-<X-Envelope-From: <fromuser@???>
-<X-Envelope-To: userx@???
-<Received: from fromuser (helo=test.ex)
-<    by myhost.test.ex with local-esmtp (Exim x.yz)
-<    (envelope-from <fromuser@???>)
-<    id 10HmaX-0005vi-00
-<    for userx@???; Tue, 2 Mar 1999 09:44:33 +0000
-<Content-type: text/plain
-<Message-Id: <E10HmaX-0005vi-00@???>
-<From: fromuser@???
-<Date: Tue, 2 Mar 1999 09:44:33 +0000
-<
-<test
->SPAMD/1.1 0 EX_OK
->Spam: False ; 4.5 / 5.0
->
->Spam detection software, running on the system "demo",
->has NOT identified this incoming email as spam.  The original
->message has been attached to this so you can view it or label
->similar future email.  If you have any questions, see
->@@CONTACT_ADDRESS@@ for details.
->
->Content preview:  test [...]
->
->Content analysis details:   (4.5 points, 5.0 required)
->
-> pts rule name              description
->---- ---------------------- --------------------------------------------------
->-1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP
-> 1.2 MISSING_HEADERS        Missing To: header
-> 1.0 MISSING_FROM           Missing From: header
-> 1.8 MISSING_SUBJECT        Missing Subject: header
-> 1.4 MISSING_DATE           Missing Date: header
-> 0.1 MISSING_MID            Missing Message-Id: header
->
-Expected EOF read from client
-End of script
-Listening on port 7833 ... 
-Connection request from [127.0.0.1]
-<REPORT SPAMC/1.2
-<User: nobody
-<Content-length: ddd
-<
-<From MAILER-DAEMON Tue Mar 02 09:44:33 1999
-<X-Envelope-From: <fromuser@???>
-<X-Envelope-To: userx@???
-<Received: from fromuser (helo=test.ex)
-<    by myhost.test.ex with local-esmtp (Exim x.yz)
-<    (envelope-from <fromuser@???>)
-<    id 10HmaY-0005vi-00
-<    for userx@???; Tue, 2 Mar 1999 09:44:33 +0000
-<Content-type: text/plain
-<Message-Id: <E10HmaY-0005vi-00@???>
-<From: fromuser@???
-<Date: Tue, 2 Mar 1999 09:44:33 +0000
-<
-<test
->SPAMD/1.1 0 EX_OK
->Spam: False ; 4.5 / 5.0
->
->Spam detection software, running on the system "demo",
->has NOT identified this incoming email as spam.  The original
->message has been attached to this so you can view it or label
->similar future email.  If you have any questions, see
->@@CONTACT_ADDRESS@@ for details.
->
->Content preview:  test [...]
->
->Content analysis details:   (4.5 points, 5.0 required)
->
-> pts rule name              description
->---- ---------------------- --------------------------------------------------
->-1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP
-> 1.2 MISSING_HEADERS        Missing To: header
-> 1.0 MISSING_FROM           Missing From: header
-> 1.8 MISSING_SUBJECT        Missing Subject: header
-> 1.4 MISSING_DATE           Missing Date: header
-> 0.1 MISSING_MID            Missing Message-Id: header
->
-Expected EOF read from client
-End of script
-Inital pause of 2 seconds
-Listening on port 7833 ... 
-Connection request from [127.0.0.1]
-<REPORT SPAMC/1.2
-<User: nobody
-<Content-length: ddd
-<
-<From MAILER-DAEMON Tue Mar 02 09:44:33 1999
-<X-Envelope-From: <fromuser@???>
-<X-Envelope-To: userx@???
-<Received: from fromuser (helo=test.ex)
-<    by myhost.test.ex with local-esmtp (Exim x.yz)
-<    (envelope-from <fromuser@???>)
-<    id 10HmaZ-0005vi-00
-<    for userx@???; Tue, 2 Mar 1999 09:44:33 +0000
-<Content-type: text/plain
-<Message-Id: <E10HmaZ-0005vi-00@???>
-<From: fromuser@???
-<Date: Tue, 2 Mar 1999 09:44:33 +0000
-<
-<test
->SPAMD/1.1 0 EX_OK
->Spam: False ; 4.5 / 5.0
->
->Spam detection software, running on the system "demo",
->has NOT identified this incoming email as spam.  The original
->message has been attached to this so you can view it or label
->similar future email.  If you have any questions, see
->@@CONTACT_ADDRESS@@ for details.
->
->Content preview:  test [...]
->
->Content analysis details:   (4.5 points, 5.0 required)
->
-> pts rule name              description
->---- ---------------------- --------------------------------------------------
->-1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP
-> 1.2 MISSING_HEADERS        Missing To: header
-> 1.0 MISSING_FROM           Missing From: header
-> 1.8 MISSING_SUBJECT        Missing Subject: header
-> 1.4 MISSING_DATE           Missing Date: header
-> 0.1 MISSING_MID            Missing Message-Id: header
->
-Expected EOF read from client
-End of script
-Listening on port 7833 ... 
-Connection request from [127.0.0.1]
-<REPORT SPAMC/1.2
-<User: nobody
-<Content-length: ddd
-<
-<From MAILER-DAEMON Tue Mar 02 09:44:33 1999
-<X-Envelope-From: <fromuser@???>
-<X-Envelope-To: userx@???
-<Received: from fromuser (helo=test.ex)
-<    by myhost.test.ex with local-esmtp (Exim x.yz)
-<    (envelope-from <fromuser@???>)
-<    id 10HmbA-0005vi-00
-<    for userx@???; Tue, 2 Mar 1999 09:44:33 +0000
-<Content-type: text/plain
-<Message-Id: <E10HmbA-0005vi-00@???>
-<From: fromuser@???
-<Date: Tue, 2 Mar 1999 09:44:33 +0000
-<
-<test
->SPAMD/1.1 0 EX_OK
->Spam: False ; 4.5 / 5.0
->
->Spam detection software, running on the system "demo",
->has NOT identified this incoming email as spam.  The original
->message has been attached to this so you can view it or label
->similar future email.  If you have any questions, see
->@@CONTACT_ADDRESS@@ for details.
->
->Content preview:  test [...]
->
->Content analysis details:   (4.5 points, 5.0 required)
->
-> pts rule name              description
->---- ---------------------- --------------------------------------------------
->-1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP
-> 1.2 MISSING_HEADERS        Missing To: header
-> 1.0 MISSING_FROM           Missing From: header
-> 1.8 MISSING_SUBJECT        Missing Subject: header
-> 1.4 MISSING_DATE           Missing Date: header
-> 0.1 MISSING_MID            Missing Message-Id: header
->
-Expected EOF read from client
-End of script
diff --git a/test/stdout/4003 b/test/stdout/4003
index afff4e4..5c16c63 100644
--- a/test/stdout/4003
+++ b/test/stdout/4003
@@ -1,5 +1,5 @@
 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
-250-myhost.test.ex Hello CALLER at test.ex
+250-myhost.test.ex Hello fromuser at test.ex
 250-SIZE 52428800
 250-8BITMIME
 250-PIPELINING
@@ -9,39 +9,215 @@
 354 Enter message, ending with "." on a line by itself
 250 OK id=10HmaX-0005vi-00
 221 myhost.test.ex closing connection
+220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+250-myhost.test.ex Hello fromuser at test.ex
+250-SIZE 52428800
+250-8BITMIME
+250-PIPELINING
+250 HELP
+250 OK
+250 Accepted
+354 Enter message, ending with "." on a line by itself
+250 OK id=10HmaY-0005vi-00
+221 myhost.test.ex closing connection
+220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+250-myhost.test.ex Hello fromuser at test.ex
+250-SIZE 52428800
+250-8BITMIME
+250-PIPELINING
+250 HELP
+250 OK
+250 Accepted
+354 Enter message, ending with "." on a line by itself
+250 OK id=10HmaZ-0005vi-00
+221 myhost.test.ex closing connection
+220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+250-myhost.test.ex Hello fromuser at test.ex
+250-SIZE 52428800
+250-8BITMIME
+250-PIPELINING
+250 HELP
+250 OK
+250 Accepted
+354 Enter message, ending with "." on a line by itself
+250 OK id=10HmbA-0005vi-00
+221 myhost.test.ex closing connection


 ******** SERVER ********
-Listening on port 11333 ... 
+Listening on port 7833 ... 
 Connection request from [127.0.0.1]
-<CHECK RSPAMC/1.3
+<REPORT SPAMC/1.2
+<User: nobody
 <Content-length: ddd
-<Queue-Id: 10HmaX-0005vi-00
-<From: <CALLER@???>
-<Recipient-Number: 1
-<Rcpt: <userx@???>
-<Helo: test.ex
-<User: CALLER
 <
 <From MAILER-DAEMON Tue Mar 02 09:44:33 1999
-<X-Envelope-From: <CALLER@???>
+<X-Envelope-From: <fromuser@???>
 <X-Envelope-To: userx@???
-<Received: from CALLER (helo=test.ex)
+<Received: from fromuser (helo=test.ex)
 <    by myhost.test.ex with local-esmtp (Exim x.yz)
-<    (envelope-from <CALLER@???>)
+<    (envelope-from <fromuser@???>)
 <    id 10HmaX-0005vi-00
 <    for userx@???; Tue, 2 Mar 1999 09:44:33 +0000
-<From: MAILER_DAEMON <>
 <Content-type: text/plain
 <Message-Id: <E10HmaX-0005vi-00@???>
-<Sender: CALLER_NAME <CALLER@???>
+<From: fromuser@???
+<Date: Tue, 2 Mar 1999 09:44:33 +0000
+<
+<test
+>SPAMD/1.1 0 EX_OK
+>Spam: False ; 4.5 / 5.0
+>
+>Spam detection software, running on the system "demo",
+>has NOT identified this incoming email as spam.  The original
+>message has been attached to this so you can view it or label
+>similar future email.  If you have any questions, see
+>@@CONTACT_ADDRESS@@ for details.
+>
+>Content preview:  test [...]
+>
+>Content analysis details:   (4.5 points, 5.0 required)
+>
+> pts rule name              description
+>---- ---------------------- --------------------------------------------------
+>-1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP
+> 1.2 MISSING_HEADERS        Missing To: header
+> 1.0 MISSING_FROM           Missing From: header
+> 1.8 MISSING_SUBJECT        Missing Subject: header
+> 1.4 MISSING_DATE           Missing Date: header
+> 0.1 MISSING_MID            Missing Message-Id: header
+>
+Expected EOF read from client
+End of script
+Listening on port 7833 ... 
+Connection request from [127.0.0.1]
+<REPORT SPAMC/1.2
+<User: nobody
+<Content-length: ddd
+<
+<From MAILER-DAEMON Tue Mar 02 09:44:33 1999
+<X-Envelope-From: <fromuser@???>
+<X-Envelope-To: userx@???
+<Received: from fromuser (helo=test.ex)
+<    by myhost.test.ex with local-esmtp (Exim x.yz)
+<    (envelope-from <fromuser@???>)
+<    id 10HmaY-0005vi-00
+<    for userx@???; Tue, 2 Mar 1999 09:44:33 +0000
+<Content-type: text/plain
+<Message-Id: <E10HmaY-0005vi-00@???>
+<From: fromuser@???
+<Date: Tue, 2 Mar 1999 09:44:33 +0000
+<
+<test
+>SPAMD/1.1 0 EX_OK
+>Spam: False ; 4.5 / 5.0
+>
+>Spam detection software, running on the system "demo",
+>has NOT identified this incoming email as spam.  The original
+>message has been attached to this so you can view it or label
+>similar future email.  If you have any questions, see
+>@@CONTACT_ADDRESS@@ for details.
+>
+>Content preview:  test [...]
+>
+>Content analysis details:   (4.5 points, 5.0 required)
+>
+> pts rule name              description
+>---- ---------------------- --------------------------------------------------
+>-1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP
+> 1.2 MISSING_HEADERS        Missing To: header
+> 1.0 MISSING_FROM           Missing From: header
+> 1.8 MISSING_SUBJECT        Missing Subject: header
+> 1.4 MISSING_DATE           Missing Date: header
+> 0.1 MISSING_MID            Missing Message-Id: header
+>
+Expected EOF read from client
+End of script
+Inital pause of 2 seconds
+Listening on port 7833 ... 
+Connection request from [127.0.0.1]
+<REPORT SPAMC/1.2
+<User: nobody
+<Content-length: ddd
+<
+<From MAILER-DAEMON Tue Mar 02 09:44:33 1999
+<X-Envelope-From: <fromuser@???>
+<X-Envelope-To: userx@???
+<Received: from fromuser (helo=test.ex)
+<    by myhost.test.ex with local-esmtp (Exim x.yz)
+<    (envelope-from <fromuser@???>)
+<    id 10HmaZ-0005vi-00
+<    for userx@???; Tue, 2 Mar 1999 09:44:33 +0000
+<Content-type: text/plain
+<Message-Id: <E10HmaZ-0005vi-00@???>
+<From: fromuser@???
+<Date: Tue, 2 Mar 1999 09:44:33 +0000
+<
+<test
+>SPAMD/1.1 0 EX_OK
+>Spam: False ; 4.5 / 5.0
+>
+>Spam detection software, running on the system "demo",
+>has NOT identified this incoming email as spam.  The original
+>message has been attached to this so you can view it or label
+>similar future email.  If you have any questions, see
+>@@CONTACT_ADDRESS@@ for details.
+>
+>Content preview:  test [...]
+>
+>Content analysis details:   (4.5 points, 5.0 required)
+>
+> pts rule name              description
+>---- ---------------------- --------------------------------------------------
+>-1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP
+> 1.2 MISSING_HEADERS        Missing To: header
+> 1.0 MISSING_FROM           Missing From: header
+> 1.8 MISSING_SUBJECT        Missing Subject: header
+> 1.4 MISSING_DATE           Missing Date: header
+> 0.1 MISSING_MID            Missing Message-Id: header
+>
+Expected EOF read from client
+End of script
+Listening on port 7833 ... 
+Connection request from [127.0.0.1]
+<REPORT SPAMC/1.2
+<User: nobody
+<Content-length: ddd
+<
+<From MAILER-DAEMON Tue Mar 02 09:44:33 1999
+<X-Envelope-From: <fromuser@???>
+<X-Envelope-To: userx@???
+<Received: from fromuser (helo=test.ex)
+<    by myhost.test.ex with local-esmtp (Exim x.yz)
+<    (envelope-from <fromuser@???>)
+<    id 10HmbA-0005vi-00
+<    for userx@???; Tue, 2 Mar 1999 09:44:33 +0000
+<Content-type: text/plain
+<Message-Id: <E10HmbA-0005vi-00@???>
+<From: fromuser@???
 <Date: Tue, 2 Mar 1999 09:44:33 +0000
 <
 <test
->RSPAMD/1.3 0 EX_OK
->Metric: default; True; 15.00 / 15.00 / 0.0
->Action: reject
->Symbol: FAKE_SYMBOL_A(15.00)
->Symbol: FAKE_SYMBOL_B(0.00)
->Message-ID: undef
+>SPAMD/1.1 0 EX_OK
+>Spam: False ; 4.5 / 5.0
+>
+>Spam detection software, running on the system "demo",
+>has NOT identified this incoming email as spam.  The original
+>message has been attached to this so you can view it or label
+>similar future email.  If you have any questions, see
+>@@CONTACT_ADDRESS@@ for details.
+>
+>Content preview:  test [...]
+>
+>Content analysis details:   (4.5 points, 5.0 required)
+>
+> pts rule name              description
+>---- ---------------------- --------------------------------------------------
+>-1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP
+> 1.2 MISSING_HEADERS        Missing To: header
+> 1.0 MISSING_FROM           Missing From: header
+> 1.8 MISSING_SUBJECT        Missing Subject: header
+> 1.4 MISSING_DATE           Missing Date: header
+> 0.1 MISSING_MID            Missing Message-Id: header
+>
 Expected EOF read from client
 End of script
diff --git a/test/stdout/4003 b/test/stdout/4004
similarity index 100%
copy from test/stdout/4003
copy to test/stdout/4004